1 /*
2 * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
14 #include "internal/ssl_unwrap.h"
15
16 #define COOKIE_STATE_FORMAT_VERSION 1
17
18 /*
19 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
20 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
21 * key_share present flag, 8 bytes for timestamp, 2 bytes for the hashlen,
22 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
23 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 */
25 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 8 + 2 + EVP_MAX_MD_SIZE + 1 \
26 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
27
28 /*
29 * Message header + 2 bytes for protocol version + number of random bytes +
30 * + 1 byte for legacy session id length + number of bytes in legacy session id
31 * + 2 bytes for ciphersuite + 1 byte for legacy compression
32 * + 2 bytes for extension block length + 6 bytes for key_share extension
33 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 */
35 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
36 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
37 + MAX_COOKIE_SIZE)
38
39 /*
40 * Parse the client's renegotiation binding and abort if it's not right
41 */
tls_parse_ctos_renegotiate(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)42 int tls_parse_ctos_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
43 unsigned int context,
44 X509 *x, size_t chainidx)
45 {
46 unsigned int ilen;
47 const unsigned char *data;
48 int ok;
49
50 /* Parse the length byte */
51 if (!PACKET_get_1(pkt, &ilen)
52 || !PACKET_get_bytes(pkt, &data, ilen)) {
53 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
54 return 0;
55 }
56
57 /* Check that the extension matches */
58 if (ilen != s->s3.previous_client_finished_len) {
59 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH);
60 return 0;
61 }
62
63 ok = memcmp(data, s->s3.previous_client_finished,
64 s->s3.previous_client_finished_len);
65 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
66 if (ok) {
67 if ((data[0] ^ s->s3.previous_client_finished[0]) != 0xFF) {
68 ok = 0;
69 }
70 }
71 #endif
72 if (ok) {
73 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH);
74 return 0;
75 }
76
77 s->s3.send_connection_binding = 1;
78
79 return 1;
80 }
81
82 /*-
83 * The servername extension is treated as follows:
84 *
85 * - Only the hostname type is supported with a maximum length of 255.
86 * - The servername is rejected if too long or if it contains zeros,
87 * in which case an fatal alert is generated.
88 * - The servername field is maintained together with the session cache.
89 * - When a session is resumed, the servername call back invoked in order
90 * to allow the application to position itself to the right context.
91 * - The servername is acknowledged if it is new for a session or when
92 * it is identical to a previously used for the same session.
93 * Applications can control the behaviour. They can at any time
94 * set a 'desirable' servername for a new SSL object. This can be the
95 * case for example with HTTPS when a Host: header field is received and
96 * a renegotiation is requested. In this case, a possible servername
97 * presented in the new client hello is only acknowledged if it matches
98 * the value of the Host: field.
99 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
100 * if they provide for changing an explicit servername context for the
101 * session, i.e. when the session has been established with a servername
102 * extension.
103 * - On session reconnect, the servername extension may be absent.
104 */
tls_parse_ctos_server_name(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)105 int tls_parse_ctos_server_name(SSL_CONNECTION *s, PACKET *pkt,
106 unsigned int context, X509 *x, size_t chainidx)
107 {
108 unsigned int servname_type;
109 PACKET sni, hostname;
110
111 if (!PACKET_as_length_prefixed_2(pkt, &sni)
112 /* ServerNameList must be at least 1 byte long. */
113 || PACKET_remaining(&sni) == 0) {
114 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
115 return 0;
116 }
117
118 /*
119 * Although the intent was for server_name to be extensible, RFC 4366
120 * was not clear about it; and so OpenSSL among other implementations,
121 * always and only allows a 'host_name' name types.
122 * RFC 6066 corrected the mistake but adding new name types
123 * is nevertheless no longer feasible, so act as if no other
124 * SNI types can exist, to simplify parsing.
125 *
126 * Also note that the RFC permits only one SNI value per type,
127 * i.e., we can only have a single hostname.
128 */
129 if (!PACKET_get_1(&sni, &servname_type)
130 || servname_type != TLSEXT_NAMETYPE_host_name
131 || !PACKET_as_length_prefixed_2(&sni, &hostname)) {
132 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
133 return 0;
134 }
135
136 /*
137 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
138 * we always use the SNI value from the handshake.
139 */
140 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) {
141 if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) {
142 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION);
143 return 0;
144 }
145
146 if (PACKET_contains_zero_byte(&hostname)) {
147 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION);
148 return 0;
149 }
150
151 /*
152 * Store the requested SNI in the SSL as temporary storage.
153 * If we accept it, it will get stored in the SSL_SESSION as well.
154 */
155 OPENSSL_free(s->ext.hostname);
156 s->ext.hostname = NULL;
157 if (!PACKET_strndup(&hostname, &s->ext.hostname)) {
158 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
159 return 0;
160 }
161
162 s->servername_done = 1;
163 } else {
164 /*
165 * In TLSv1.2 and below we should check if the SNI is consistent between
166 * the initial handshake and the resumption. In TLSv1.3 SNI is not
167 * associated with the session.
168 */
169 s->servername_done = (s->session->ext.hostname != NULL)
170 && PACKET_equal(&hostname, s->session->ext.hostname,
171 strlen(s->session->ext.hostname));
172 }
173
174 return 1;
175 }
176
tls_parse_ctos_maxfragmentlen(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)177 int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
178 unsigned int context,
179 X509 *x, size_t chainidx)
180 {
181 unsigned int value;
182
183 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) {
184 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
185 return 0;
186 }
187
188 /* Received |value| should be a valid max-fragment-length code. */
189 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
190 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
191 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
192 return 0;
193 }
194
195 /*
196 * When doing a full handshake or a renegotiation max_fragment_len_mode will
197 * be TLSEXT_max_fragment_length_UNSPECIFIED
198 *
199 * In case of a resumption max_fragment_len_mode will be one of
200 * TLSEXT_max_fragment_length_DISABLED, TLSEXT_max_fragment_length_512,
201 * TLSEXT_max_fragment_length_1024, TLSEXT_max_fragment_length_2048.
202 * TLSEXT_max_fragment_length_4096
203 *
204 * RFC 6066: The negotiated length applies for the duration of the session
205 * including session resumptions.
206 *
207 * So we only set the value in case it is unspecified.
208 */
209 if (s->session->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_UNSPECIFIED)
210 /*
211 * Store it in session, so it'll become binding for us
212 * and we'll include it in a next Server Hello.
213 */
214 s->session->ext.max_fragment_len_mode = value;
215
216 return 1;
217 }
218
219 #ifndef OPENSSL_NO_SRP
tls_parse_ctos_srp(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)220 int tls_parse_ctos_srp(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
221 X509 *x, size_t chainidx)
222 {
223 PACKET srp_I;
224
225 if (!PACKET_as_length_prefixed_1(pkt, &srp_I)
226 || PACKET_contains_zero_byte(&srp_I)) {
227 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
228 return 0;
229 }
230
231 if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) {
232 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
233 return 0;
234 }
235
236 return 1;
237 }
238 #endif
239
tls_parse_ctos_ec_pt_formats(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)240 int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
241 unsigned int context,
242 X509 *x, size_t chainidx)
243 {
244 PACKET ec_point_format_list;
245
246 if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list)
247 || PACKET_remaining(&ec_point_format_list) == 0) {
248 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
249 return 0;
250 }
251
252 if (!s->hit) {
253 if (!PACKET_memdup(&ec_point_format_list,
254 &s->ext.peer_ecpointformats,
255 &s->ext.peer_ecpointformats_len)) {
256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
257 return 0;
258 }
259 }
260
261 return 1;
262 }
263
tls_parse_ctos_session_ticket(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)264 int tls_parse_ctos_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
265 unsigned int context,
266 X509 *x, size_t chainidx)
267 {
268 if (s->ext.session_ticket_cb &&
269 !s->ext.session_ticket_cb(SSL_CONNECTION_GET_USER_SSL(s),
270 PACKET_data(pkt), PACKET_remaining(pkt),
271 s->ext.session_ticket_cb_arg)) {
272 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
273 return 0;
274 }
275
276 return 1;
277 }
278
tls_parse_ctos_sig_algs_cert(SSL_CONNECTION * s,PACKET * pkt,ossl_unused unsigned int context,ossl_unused X509 * x,ossl_unused size_t chainidx)279 int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION *s, PACKET *pkt,
280 ossl_unused unsigned int context,
281 ossl_unused X509 *x,
282 ossl_unused size_t chainidx)
283 {
284 PACKET supported_sig_algs;
285
286 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
287 || PACKET_remaining(&supported_sig_algs) == 0) {
288 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
289 return 0;
290 }
291
292 /*
293 * We use this routine on both clients and servers, and when clients
294 * get asked for PHA we need to always save the sigalgs regardless
295 * of whether it was a resumption or not.
296 */
297 if ((!s->server || (s->server && !s->hit))
298 && !tls1_save_sigalgs(s, &supported_sig_algs, 1)) {
299 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
300 return 0;
301 }
302
303 return 1;
304 }
305
tls_parse_ctos_sig_algs(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)306 int tls_parse_ctos_sig_algs(SSL_CONNECTION *s, PACKET *pkt,
307 unsigned int context, X509 *x, size_t chainidx)
308 {
309 PACKET supported_sig_algs;
310
311 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
312 || PACKET_remaining(&supported_sig_algs) == 0) {
313 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
314 return 0;
315 }
316
317 /*
318 * We use this routine on both clients and servers, and when clients
319 * get asked for PHA we need to always save the sigalgs regardless
320 * of whether it was a resumption or not.
321 */
322 if ((!s->server || (s->server && !s->hit))
323 && !tls1_save_sigalgs(s, &supported_sig_algs, 0)) {
324 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
325 return 0;
326 }
327
328 return 1;
329 }
330
331 #ifndef OPENSSL_NO_OCSP
tls_parse_ctos_status_request(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)332 int tls_parse_ctos_status_request(SSL_CONNECTION *s, PACKET *pkt,
333 unsigned int context,
334 X509 *x, size_t chainidx)
335 {
336 PACKET responder_id_list, exts;
337
338 /* We ignore this in a resumption handshake */
339 if (s->hit)
340 return 1;
341
342 /* Not defined if we get one of these in a client Certificate */
343 if (x != NULL)
344 return 1;
345
346 if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) {
347 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
348 return 0;
349 }
350
351 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
352 /*
353 * We don't know what to do with any other type so ignore it.
354 */
355 s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
356 return 1;
357 }
358
359 if (!PACKET_get_length_prefixed_2 (pkt, &responder_id_list)) {
360 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
361 return 0;
362 }
363
364 /*
365 * We remove any OCSP_RESPIDs from a previous handshake
366 * to prevent unbounded memory growth - CVE-2016-6304
367 */
368 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
369 if (PACKET_remaining(&responder_id_list) > 0) {
370 s->ext.ocsp.ids = sk_OCSP_RESPID_new_null();
371 if (s->ext.ocsp.ids == NULL) {
372 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
373 return 0;
374 }
375 } else {
376 s->ext.ocsp.ids = NULL;
377 }
378
379 while (PACKET_remaining(&responder_id_list) > 0) {
380 OCSP_RESPID *id;
381 PACKET responder_id;
382 const unsigned char *id_data;
383
384 if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id)
385 || PACKET_remaining(&responder_id) == 0) {
386 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
387 return 0;
388 }
389
390 id_data = PACKET_data(&responder_id);
391 id = d2i_OCSP_RESPID(NULL, &id_data,
392 (int)PACKET_remaining(&responder_id));
393 if (id == NULL) {
394 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
395 return 0;
396 }
397
398 if (id_data != PACKET_end(&responder_id)) {
399 OCSP_RESPID_free(id);
400 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
401
402 return 0;
403 }
404
405 if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) {
406 OCSP_RESPID_free(id);
407 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
408
409 return 0;
410 }
411 }
412
413 /* Read in request_extensions */
414 if (!PACKET_as_length_prefixed_2(pkt, &exts)) {
415 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
416 return 0;
417 }
418
419 if (PACKET_remaining(&exts) > 0) {
420 const unsigned char *ext_data = PACKET_data(&exts);
421
422 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts,
423 X509_EXTENSION_free);
424 s->ext.ocsp.exts =
425 d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts));
426 if (s->ext.ocsp.exts == NULL || ext_data != PACKET_end(&exts)) {
427 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
428 return 0;
429 }
430 }
431
432 return 1;
433 }
434 #endif
435
436 #ifndef OPENSSL_NO_NEXTPROTONEG
tls_parse_ctos_npn(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)437 int tls_parse_ctos_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
438 X509 *x, size_t chainidx)
439 {
440 /*
441 * We shouldn't accept this extension on a
442 * renegotiation.
443 */
444 if (SSL_IS_FIRST_HANDSHAKE(s))
445 s->s3.npn_seen = 1;
446
447 return 1;
448 }
449 #endif
450
451 /*
452 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
453 * extension, not including type and length. Returns: 1 on success, 0 on error.
454 */
tls_parse_ctos_alpn(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)455 int tls_parse_ctos_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
456 X509 *x, size_t chainidx)
457 {
458 PACKET protocol_list, save_protocol_list, protocol;
459
460 if (!SSL_IS_FIRST_HANDSHAKE(s))
461 return 1;
462
463 if (!PACKET_as_length_prefixed_2(pkt, &protocol_list)
464 || PACKET_remaining(&protocol_list) < 2) {
465 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
466 return 0;
467 }
468
469 save_protocol_list = protocol_list;
470 do {
471 /* Protocol names can't be empty. */
472 if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol)
473 || PACKET_remaining(&protocol) == 0) {
474 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
475 return 0;
476 }
477 } while (PACKET_remaining(&protocol_list) != 0);
478
479 OPENSSL_free(s->s3.alpn_proposed);
480 s->s3.alpn_proposed = NULL;
481 s->s3.alpn_proposed_len = 0;
482 if (!PACKET_memdup(&save_protocol_list,
483 &s->s3.alpn_proposed, &s->s3.alpn_proposed_len)) {
484 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
485 return 0;
486 }
487
488 return 1;
489 }
490
491 #ifndef OPENSSL_NO_SRTP
tls_parse_ctos_use_srtp(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)492 int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
493 unsigned int context, X509 *x, size_t chainidx)
494 {
495 STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
496 unsigned int ct, mki_len, id;
497 int i, srtp_pref;
498 PACKET subpkt;
499 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
500
501 /* Ignore this if we have no SRTP profiles */
502 if (SSL_get_srtp_profiles(ssl) == NULL)
503 return 1;
504
505 /* Pull off the length of the cipher suite list and check it is even */
506 if (!PACKET_get_net_2(pkt, &ct) || (ct & 1) != 0
507 || !PACKET_get_sub_packet(pkt, &subpkt, ct)) {
508 SSLfatal(s, SSL_AD_DECODE_ERROR,
509 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
510 return 0;
511 }
512
513 srvr = SSL_get_srtp_profiles(ssl);
514 s->srtp_profile = NULL;
515 /* Search all profiles for a match initially */
516 srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
517
518 while (PACKET_remaining(&subpkt)) {
519 if (!PACKET_get_net_2(&subpkt, &id)) {
520 SSLfatal(s, SSL_AD_DECODE_ERROR,
521 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
522 return 0;
523 }
524
525 /*
526 * Only look for match in profiles of higher preference than
527 * current match.
528 * If no profiles have been have been configured then this
529 * does nothing.
530 */
531 for (i = 0; i < srtp_pref; i++) {
532 SRTP_PROTECTION_PROFILE *sprof =
533 sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
534
535 if (sprof->id == id) {
536 s->srtp_profile = sprof;
537 srtp_pref = i;
538 break;
539 }
540 }
541 }
542
543 /* Now extract the MKI value as a sanity check, but discard it for now */
544 if (!PACKET_get_1(pkt, &mki_len)) {
545 SSLfatal(s, SSL_AD_DECODE_ERROR,
546 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
547 return 0;
548 }
549
550 if (!PACKET_forward(pkt, mki_len)
551 || PACKET_remaining(pkt)) {
552 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_SRTP_MKI_VALUE);
553 return 0;
554 }
555
556 return 1;
557 }
558 #endif
559
tls_parse_ctos_etm(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)560 int tls_parse_ctos_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
561 X509 *x, size_t chainidx)
562 {
563 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
564 s->ext.use_etm = 1;
565
566 return 1;
567 }
568
569 /*
570 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
571 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
572 */
tls_parse_ctos_psk_kex_modes(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)573 int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION *s, PACKET *pkt,
574 unsigned int context,
575 X509 *x, size_t chainidx)
576 {
577 #ifndef OPENSSL_NO_TLS1_3
578 PACKET psk_kex_modes;
579 unsigned int mode;
580
581 if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes)
582 || PACKET_remaining(&psk_kex_modes) == 0) {
583 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
584 return 0;
585 }
586
587 while (PACKET_get_1(&psk_kex_modes, &mode)) {
588 if (mode == TLSEXT_KEX_MODE_KE_DHE)
589 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE;
590 else if (mode == TLSEXT_KEX_MODE_KE
591 && (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0)
592 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
593 }
594
595 if (((s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) != 0)
596 && (s->options & SSL_OP_PREFER_NO_DHE_KEX) != 0) {
597
598 /*
599 * If NO_DHE is supported and preferred, then we only remember this
600 * mode. DHE PSK will not be used for sure, because in any case where
601 * it would be supported (i.e. if a key share is present), NO_DHE would
602 * be supported as well. As the latter is preferred it would be
603 * chosen. By removing DHE PSK here, we don't have to deal with the
604 * SSL_OP_PREFER_NO_DHE_KEX option in any other place.
605 */
606 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE;
607 }
608
609 #endif
610
611 return 1;
612 }
613
614 /*
615 * Use function tls_parse_ctos_key_share with helper functions extract_keyshares,
616 * check_overlap and tls_accept_ksgroup to parse the key_share extension(s)
617 * received in the ClientHello and to select the group used of the key exchange
618 */
619
620 #ifndef OPENSSL_NO_TLS1_3
621 /*
622 * Accept a key share group by setting the related variables in s->s3 and
623 * by generating a pubkey for this group
624 */
tls_accept_ksgroup(SSL_CONNECTION * s,uint16_t ksgroup,PACKET * encoded_pubkey)625 static int tls_accept_ksgroup(SSL_CONNECTION *s, uint16_t ksgroup, PACKET *encoded_pubkey)
626 {
627 /* Accept the key share group */
628 s->s3.group_id = ksgroup;
629 s->s3.group_id_candidate = ksgroup;
630 /* Cache the selected group ID in the SSL_SESSION */
631 s->session->kex_group = ksgroup;
632 if ((s->s3.peer_tmp = ssl_generate_param_group(s, ksgroup)) == NULL) {
633 SSLfatal(s,
634 SSL_AD_INTERNAL_ERROR,
635 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
636 return 0;
637 }
638 if (tls13_set_encoded_pub_key(s->s3.peer_tmp,
639 PACKET_data(encoded_pubkey),
640 PACKET_remaining(encoded_pubkey)) <= 0) {
641 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
642 return 0;
643 }
644 return 1;
645 }
646
647 # define GROUPLIST_INCREMENT 32 /* Memory allocation chunk size (nominally 64 Bytes chunks) */
648
649 typedef enum KS_EXTRACTION_RESULT {
650 EXTRACTION_FAILURE,
651 EXTRACTION_SUCCESS,
652 EXTRACTION_SUCCESS_HRR
653 } KS_EXTRACTION_RESULT;
654
extract_keyshares(SSL_CONNECTION * s,PACKET * key_share_list,const uint16_t * clntgroups,size_t clnt_num_groups,const uint16_t * srvrgroups,size_t srvr_num_groups,uint16_t ** keyshares_arr,PACKET ** encoded_pubkey_arr,size_t * keyshares_cnt,size_t * keyshares_max)655 static KS_EXTRACTION_RESULT extract_keyshares(SSL_CONNECTION *s, PACKET *key_share_list,
656 const uint16_t *clntgroups, size_t clnt_num_groups,
657 const uint16_t *srvrgroups, size_t srvr_num_groups,
658 uint16_t **keyshares_arr, PACKET **encoded_pubkey_arr,
659 size_t *keyshares_cnt, size_t *keyshares_max)
660 {
661 PACKET encoded_pubkey;
662 size_t key_share_pos = 0;
663 size_t previous_key_share_pos = 0;
664 unsigned int group_id = 0;
665
666 /* Prepare memory to hold the extracted key share groups and related pubkeys */
667 *keyshares_arr = OPENSSL_malloc(*keyshares_max * sizeof(**keyshares_arr));
668 if (*keyshares_arr == NULL) {
669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
670 goto failure;
671 }
672 *encoded_pubkey_arr = OPENSSL_malloc(*keyshares_max * sizeof(**encoded_pubkey_arr));
673 if (*encoded_pubkey_arr == NULL) {
674 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
675 goto failure;
676 }
677
678 while (PACKET_remaining(key_share_list) > 0) {
679 /* Get the group_id for the current share and its encoded_pubkey */
680 if (!PACKET_get_net_2(key_share_list, &group_id)
681 || !PACKET_get_length_prefixed_2(key_share_list, &encoded_pubkey)
682 || PACKET_remaining(&encoded_pubkey) == 0) {
683 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
684 goto failure;
685 }
686
687 /*
688 * If we sent an HRR then the key_share sent back MUST be for the group
689 * we requested, and must be the only key_share sent.
690 */
691 if (s->s3.group_id != 0
692 && (group_id != s->s3.group_id
693 || PACKET_remaining(key_share_list) != 0)) {
694 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
695 goto failure;
696 }
697
698 /*
699 * Check if this share is in supported_groups sent from client
700 * RFC 8446 also mandates that clients send keyshares in the same
701 * order as listed in the supported groups extension, but its not
702 * required that the server check that, and some clients violate this
703 * so instead of failing the connection when that occurs, log a trace
704 * message indicating the client discrepancy.
705 */
706 if (!check_in_list(s, group_id, clntgroups, clnt_num_groups, 0, &key_share_pos)) {
707 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
708 goto failure;
709 }
710
711 if (key_share_pos < previous_key_share_pos)
712 OSSL_TRACE1(TLS, "key share group id %d is out of RFC 8446 order\n", group_id);
713
714 previous_key_share_pos = key_share_pos;
715
716 if (s->s3.group_id != 0) {
717 /*
718 * We have sent a HRR, and the key share we got back is
719 * the one we expected and is the only key share and is
720 * in the list of supported_groups (checked
721 * above already), hence we accept this key share group
722 */
723 if (!tls_accept_ksgroup(s, s->s3.group_id, &encoded_pubkey))
724 goto failure; /* SSLfatal already called */
725 /* We have selected a key share group via HRR, hence we're done here */
726 return EXTRACTION_SUCCESS_HRR;
727 }
728
729 /*
730 * We tolerate but ignore a group id that we don't think is
731 * suitable for TLSv1.3 or which is not supported by the server
732 */
733 if (!check_in_list(s, group_id, srvrgroups, srvr_num_groups, 1, NULL)
734 || !tls_group_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)
735 || !tls_valid_group(s, group_id, TLS1_3_VERSION, TLS1_3_VERSION,
736 0, NULL)) {
737 /* Share not suitable or not supported, check next share */
738 continue;
739 }
740
741 /* Memorize this key share group ID and its encoded point */
742 (*keyshares_arr)[*keyshares_cnt] = group_id;
743 (*encoded_pubkey_arr)[(*keyshares_cnt)++] = encoded_pubkey;
744
745 /*
746 * Memory management (remark: While limiting the client to only allow
747 * a maximum of OPENSSL_CLIENT_MAX_KEY_SHARES to be sent, the server can
748 * handle any number of key shares)
749 */
750 if (*keyshares_cnt == *keyshares_max) {
751 PACKET *tmp_pkt;
752 uint16_t *tmp =
753 OPENSSL_realloc(*keyshares_arr,
754 (*keyshares_max + GROUPLIST_INCREMENT) * sizeof(**keyshares_arr));
755
756 if (tmp == NULL)
757 goto failure;
758 *keyshares_arr = tmp;
759 tmp_pkt =
760 OPENSSL_realloc(*encoded_pubkey_arr,
761 (*keyshares_max + GROUPLIST_INCREMENT) *
762 sizeof(**encoded_pubkey_arr));
763 if (tmp_pkt == NULL)
764 goto failure;
765 *encoded_pubkey_arr = tmp_pkt;
766 *keyshares_max += GROUPLIST_INCREMENT;
767 }
768
769 }
770
771 return EXTRACTION_SUCCESS;
772
773 failure:
774 /* Fatal error -> free any allocated memory and return 0 */
775 OPENSSL_free(*keyshares_arr);
776 OPENSSL_free(*encoded_pubkey_arr);
777 return EXTRACTION_FAILURE;
778 }
779 #endif
780
781 /*
782 * For each group in the priority list of groups, check if that group is
783 * also present in the secondary list; if so, select the first overlap and
784 * assign to selected_group and also set the related index in the candidate group list,
785 * or set selected_group to 0 if no overlap
786 */
787 #ifndef OPENSSL_NO_TLS1_3
check_overlap(SSL_CONNECTION * s,const uint16_t * prio_groups,size_t prio_num_groups,const uint16_t * candidate_groups,size_t candidate_num_groups,int * prio_group_idx,int * candidate_group_idx,uint16_t * selected_group)788 static void check_overlap(SSL_CONNECTION *s,
789 const uint16_t *prio_groups, size_t prio_num_groups,
790 const uint16_t *candidate_groups, size_t candidate_num_groups,
791 int *prio_group_idx, int *candidate_group_idx,
792 uint16_t *selected_group)
793 {
794 uint16_t current_group;
795 size_t group_idx = prio_num_groups;
796 size_t new_group_idx = 0;
797
798 *candidate_group_idx = 0;
799 *prio_group_idx = 0;
800 *selected_group = 0;
801
802 for (current_group = 0; current_group < candidate_num_groups; current_group++) {
803 if (!check_in_list(s, candidate_groups[current_group], prio_groups,
804 prio_num_groups, 1, &new_group_idx)
805 || !tls_group_allowed(s, candidate_groups[current_group],
806 SSL_SECOP_CURVE_SUPPORTED)
807 || !tls_valid_group(s, candidate_groups[current_group], TLS1_3_VERSION,
808 TLS1_3_VERSION, 0, NULL))
809 /* No overlap or group not suitable, check next group */
810 continue;
811
812 /*
813 * is the found new_group_idx earlier in the priority list than
814 * initial or last group_idx?
815 */
816 if (new_group_idx < group_idx) {
817 group_idx = new_group_idx;
818 *candidate_group_idx = current_group;
819 *prio_group_idx = group_idx;
820 *selected_group = prio_groups[group_idx];
821 }
822 }
823 }
824 #endif
825
tls_parse_ctos_key_share(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)826 int tls_parse_ctos_key_share(SSL_CONNECTION *s, PACKET *pkt,
827 unsigned int context, X509 *x, size_t chainidx)
828 {
829 #ifndef OPENSSL_NO_TLS1_3
830 PACKET key_share_list;
831 const uint16_t *clntgroups, *srvrgroups;
832 const size_t *srvrtuples;
833 uint16_t *first_group_in_tuple;
834 size_t clnt_num_groups, srvr_num_groups, srvr_num_tuples;
835 PACKET *encoded_pubkey_arr = NULL;
836 uint16_t *keyshares_arr = NULL;
837 size_t keyshares_cnt = 0;
838 size_t keyshares_max = GROUPLIST_INCREMENT;
839 /* We conservatively assume that we did not find a suitable group */
840 uint16_t group_id_candidate = 0;
841 KS_EXTRACTION_RESULT ks_extraction_result;
842 size_t current_tuple;
843 int ret = 0;
844
845 s->s3.group_id_candidate = 0;
846 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0)
847 return 1;
848
849 /* Sanity check */
850 if (s->s3.peer_tmp != NULL) {
851 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
852 return 0;
853 }
854
855 if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) {
856 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
857 return 0;
858 }
859
860 /* Get list of server supported groups and the group tuples */
861 tls1_get_supported_groups(s, &srvrgroups, &srvr_num_groups);
862 tls1_get_group_tuples(s, &srvrtuples, &srvr_num_tuples);
863 /* Get the clients list of supported groups. */
864 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
865
866 if (clnt_num_groups == 0) {
867 /*
868 * This can only happen if the supported_groups extension was not sent,
869 * because we verify that the length is non-zero when we process that
870 * extension.
871 */
872 SSLfatal(s, SSL_AD_MISSING_EXTENSION,
873 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION);
874 return 0;
875 }
876
877 if (s->s3.group_id != 0 && PACKET_remaining(&key_share_list) == 0) {
878 /*
879 * If we set a group_id already, then we must have sent an HRR
880 * requesting a new key_share. If we haven't got one then that is an
881 * error
882 */
883 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
884 return 0;
885 }
886
887 /* We parse the key share extension and memorize the entries (after some checks) */
888 ks_extraction_result = extract_keyshares(s,
889 &key_share_list,
890 clntgroups, clnt_num_groups,
891 srvrgroups, srvr_num_groups,
892 &keyshares_arr, &encoded_pubkey_arr,
893 &keyshares_cnt, &keyshares_max);
894
895 if (ks_extraction_result == EXTRACTION_FAILURE) /* Fatal error during tests */
896 return 0; /* Memory already freed and SSLfatal already called */
897 if (ks_extraction_result == EXTRACTION_SUCCESS_HRR) /* Successful HRR */
898 goto end;
899
900 /*
901 * We now have the folowing lists available to make a decision for
902 * which group the server should use for key exchange :
903 * From client: clntgroups[clnt_num_groups],
904 * keyshares_arr[keyshares_cnt], encoded_pubkey_arr[keyshares_cnt]
905 * From server: srvrgroups[srvr_num_groups], srvrtuples[srvr_num_tuples]
906 *
907 * Group selection algorithm:
908 * For all tuples do:
909 * key share group(s) overlapping with current tuple?
910 * --> Yes: accept group_id for SH
911 * --> No: is any of the client supported_groups overlapping with current tuple?
912 * --> Yes: memorize group_id for HRR, break
913 * --> No: continue to check next tuple
914 *
915 * Remark: Selection priority different for client- or server-preference
916 */
917 first_group_in_tuple = (uint16_t *)srvrgroups;
918 for (current_tuple = 0; current_tuple < srvr_num_tuples; current_tuple++) {
919 size_t number_of_groups_in_tuple = srvrtuples[current_tuple];
920 int prio_group_idx = 0, candidate_group_idx = 0;
921
922 /* Server or client preference ? */
923 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
924 /* Server preference */
925 /* Is there overlap with a key share group? */
926 check_overlap(s,
927 first_group_in_tuple, number_of_groups_in_tuple,
928 keyshares_arr, keyshares_cnt,
929 &prio_group_idx, &candidate_group_idx,
930 &group_id_candidate);
931 if (group_id_candidate > 0) { /* Overlap found -> accept the key share group */
932 if (!tls_accept_ksgroup(s, group_id_candidate,
933 &encoded_pubkey_arr[candidate_group_idx]))
934 goto err; /* SSLfatal already called */
935 /* We have all info for a SH, hence we're done here */
936 goto end;
937 } else {
938 /*
939 * There's no overlap with a key share, but is there at least a client
940 * supported_group overlapping with the current tuple?
941 */
942 check_overlap(s,
943 first_group_in_tuple, number_of_groups_in_tuple,
944 clntgroups, clnt_num_groups,
945 &prio_group_idx, &candidate_group_idx,
946 &group_id_candidate);
947 if (group_id_candidate > 0) {
948 /*
949 * We did not have a key share overlap, but at least the supported
950 * groups overlap hence we can stop searching
951 * (and report group_id_candidate 'upward' for HRR)
952 */
953 s->s3.group_id_candidate = group_id_candidate;
954 goto end;
955 } else {
956 /*
957 * Neither key share nor supported_groups overlap current
958 * tuple, hence we try the next tuple
959 */
960 first_group_in_tuple = &first_group_in_tuple[number_of_groups_in_tuple];
961 continue;
962 }
963 }
964
965 } else { /* We have client preference */
966 check_overlap(s,
967 keyshares_arr, keyshares_cnt,
968 first_group_in_tuple, number_of_groups_in_tuple,
969 &prio_group_idx, &candidate_group_idx,
970 &group_id_candidate);
971 if (group_id_candidate > 0) {
972 if (!tls_accept_ksgroup(s, group_id_candidate, &encoded_pubkey_arr[prio_group_idx]))
973 goto err;
974 goto end;
975 } else {
976 check_overlap(s,
977 clntgroups, clnt_num_groups,
978 first_group_in_tuple, number_of_groups_in_tuple,
979 &prio_group_idx, &candidate_group_idx,
980 &group_id_candidate);
981 if (group_id_candidate > 0) {
982 s->s3.group_id_candidate = group_id_candidate;
983 goto end;
984 } else {
985 first_group_in_tuple = &first_group_in_tuple[number_of_groups_in_tuple];
986 continue;
987 }
988 }
989 }
990 }
991
992 end:
993 ret = 1;
994
995 err:
996 OPENSSL_free(keyshares_arr);
997 OPENSSL_free(encoded_pubkey_arr);
998 return ret;
999
1000 #endif
1001
1002 return 1;
1003 }
1004
tls_parse_ctos_cookie(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1005 int tls_parse_ctos_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1006 X509 *x, size_t chainidx)
1007 {
1008 #ifndef OPENSSL_NO_TLS1_3
1009 unsigned int format, version, key_share, group_id;
1010 EVP_MD_CTX *hctx;
1011 EVP_PKEY *pkey;
1012 PACKET cookie, raw, chhash, appcookie;
1013 WPACKET hrrpkt;
1014 const unsigned char *data, *mdin, *ciphdata;
1015 unsigned char hmac[SHA256_DIGEST_LENGTH];
1016 unsigned char hrr[MAX_HRR_SIZE];
1017 size_t rawlen, hmaclen, hrrlen, ciphlen;
1018 uint64_t tm, now;
1019 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1020 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1021
1022 /* Ignore any cookie if we're not set up to verify it */
1023 if (sctx->verify_stateless_cookie_cb == NULL
1024 || (s->s3.flags & TLS1_FLAGS_STATELESS) == 0)
1025 return 1;
1026
1027 if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
1028 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1029 return 0;
1030 }
1031
1032 raw = cookie;
1033 data = PACKET_data(&raw);
1034 rawlen = PACKET_remaining(&raw);
1035 if (rawlen < SHA256_DIGEST_LENGTH
1036 || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
1037 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1038 return 0;
1039 }
1040 mdin = PACKET_data(&raw);
1041
1042 /* Verify the HMAC of the cookie */
1043 hctx = EVP_MD_CTX_create();
1044 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC",
1045 sctx->propq,
1046 s->session_ctx->ext.cookie_hmac_key,
1047 sizeof(s->session_ctx->ext.cookie_hmac_key));
1048 if (hctx == NULL || pkey == NULL) {
1049 EVP_MD_CTX_free(hctx);
1050 EVP_PKEY_free(pkey);
1051 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
1052 return 0;
1053 }
1054
1055 hmaclen = SHA256_DIGEST_LENGTH;
1056 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx,
1057 sctx->propq, pkey, NULL) <= 0
1058 || EVP_DigestSign(hctx, hmac, &hmaclen, data,
1059 rawlen - SHA256_DIGEST_LENGTH) <= 0
1060 || hmaclen != SHA256_DIGEST_LENGTH) {
1061 EVP_MD_CTX_free(hctx);
1062 EVP_PKEY_free(pkey);
1063 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1064 return 0;
1065 }
1066
1067 EVP_MD_CTX_free(hctx);
1068 EVP_PKEY_free(pkey);
1069
1070 if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {
1071 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH);
1072 return 0;
1073 }
1074
1075 if (!PACKET_get_net_2(&cookie, &format)) {
1076 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1077 return 0;
1078 }
1079 /* Check the cookie format is something we recognise. Ignore it if not */
1080 if (format != COOKIE_STATE_FORMAT_VERSION)
1081 return 1;
1082
1083 /*
1084 * The rest of these checks really shouldn't fail since we have verified the
1085 * HMAC above.
1086 */
1087
1088 /* Check the version number is sane */
1089 if (!PACKET_get_net_2(&cookie, &version)) {
1090 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1091 return 0;
1092 }
1093 if (version != TLS1_3_VERSION) {
1094 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1095 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
1096 return 0;
1097 }
1098
1099 if (!PACKET_get_net_2(&cookie, &group_id)) {
1100 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1101 return 0;
1102 }
1103
1104 ciphdata = PACKET_data(&cookie);
1105 if (!PACKET_forward(&cookie, 2)) {
1106 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1107 return 0;
1108 }
1109 if (group_id != s->s3.group_id
1110 || s->s3.tmp.new_cipher
1111 != ssl_get_cipher_by_char(s, ciphdata, 0)) {
1112 /*
1113 * We chose a different cipher or group id this time around to what is
1114 * in the cookie. Something must have changed.
1115 */
1116 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_CIPHER);
1117 return 0;
1118 }
1119
1120 if (!PACKET_get_1(&cookie, &key_share)
1121 || !PACKET_get_net_8(&cookie, &tm)
1122 || !PACKET_get_length_prefixed_2(&cookie, &chhash)
1123 || !PACKET_get_length_prefixed_1(&cookie, &appcookie)
1124 || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {
1125 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1126 return 0;
1127 }
1128
1129 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
1130 now = time(NULL);
1131 if (tm > now || (now - tm) > 600) {
1132 /* Cookie is stale. Ignore it */
1133 return 1;
1134 }
1135
1136 /* Verify the app cookie */
1137 if (sctx->verify_stateless_cookie_cb(SSL_CONNECTION_GET_USER_SSL(s),
1138 PACKET_data(&appcookie),
1139 PACKET_remaining(&appcookie)) == 0) {
1140 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH);
1141 return 0;
1142 }
1143
1144 /*
1145 * Reconstruct the HRR that we would have sent in response to the original
1146 * ClientHello so we can add it to the transcript hash.
1147 * Note: This won't work with custom HRR extensions
1148 */
1149 if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {
1150 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1151 return 0;
1152 }
1153 if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)
1154 || !WPACKET_start_sub_packet_u24(&hrrpkt)
1155 || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)
1156 || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)
1157 || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,
1158 s->tmp_session_id_len)
1159 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, &hrrpkt,
1160 &ciphlen)
1161 || !WPACKET_put_bytes_u8(&hrrpkt, 0)
1162 || !WPACKET_start_sub_packet_u16(&hrrpkt)) {
1163 WPACKET_cleanup(&hrrpkt);
1164 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1165 return 0;
1166 }
1167 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)
1168 || !WPACKET_start_sub_packet_u16(&hrrpkt)
1169 || !WPACKET_put_bytes_u16(&hrrpkt, s->version)
1170 || !WPACKET_close(&hrrpkt)) {
1171 WPACKET_cleanup(&hrrpkt);
1172 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1173 return 0;
1174 }
1175 if (key_share) {
1176 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)
1177 || !WPACKET_start_sub_packet_u16(&hrrpkt)
1178 || !WPACKET_put_bytes_u16(&hrrpkt, s->s3.group_id)
1179 || !WPACKET_close(&hrrpkt)) {
1180 WPACKET_cleanup(&hrrpkt);
1181 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1182 return 0;
1183 }
1184 }
1185 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)
1186 || !WPACKET_start_sub_packet_u16(&hrrpkt)
1187 || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)
1188 || !WPACKET_close(&hrrpkt) /* cookie extension */
1189 || !WPACKET_close(&hrrpkt) /* extension block */
1190 || !WPACKET_close(&hrrpkt) /* message */
1191 || !WPACKET_get_total_written(&hrrpkt, &hrrlen)
1192 || !WPACKET_finish(&hrrpkt)) {
1193 WPACKET_cleanup(&hrrpkt);
1194 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1195 return 0;
1196 }
1197
1198 /* Reconstruct the transcript hash */
1199 if (!create_synthetic_message_hash(s, PACKET_data(&chhash),
1200 PACKET_remaining(&chhash), hrr,
1201 hrrlen)) {
1202 /* SSLfatal() already called */
1203 return 0;
1204 }
1205
1206 /* Act as if this ClientHello came after a HelloRetryRequest */
1207 s->hello_retry_request = SSL_HRR_PENDING;
1208
1209 s->ext.cookieok = 1;
1210 #endif
1211
1212 return 1;
1213 }
1214
tls_parse_ctos_supported_groups(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1215 int tls_parse_ctos_supported_groups(SSL_CONNECTION *s, PACKET *pkt,
1216 unsigned int context,
1217 X509 *x, size_t chainidx)
1218 {
1219 PACKET supported_groups_list;
1220
1221 /* Each group is 2 bytes and we must have at least 1. */
1222 if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list)
1223 || PACKET_remaining(&supported_groups_list) == 0
1224 || (PACKET_remaining(&supported_groups_list) % 2) != 0) {
1225 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1226 return 0;
1227 }
1228
1229 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) {
1230 OPENSSL_free(s->ext.peer_supportedgroups);
1231 s->ext.peer_supportedgroups = NULL;
1232 s->ext.peer_supportedgroups_len = 0;
1233 if (!tls1_save_u16(&supported_groups_list,
1234 &s->ext.peer_supportedgroups,
1235 &s->ext.peer_supportedgroups_len)) {
1236 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1237 return 0;
1238 }
1239 }
1240
1241 return 1;
1242 }
1243
tls_parse_ctos_ems(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1244 int tls_parse_ctos_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1245 X509 *x, size_t chainidx)
1246 {
1247 /* The extension must always be empty */
1248 if (PACKET_remaining(pkt) != 0) {
1249 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1250 return 0;
1251 }
1252
1253 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
1254 return 1;
1255
1256 s->s3.flags |= TLS1_FLAGS_RECEIVED_EXTMS;
1257
1258 return 1;
1259 }
1260
1261
tls_parse_ctos_early_data(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1262 int tls_parse_ctos_early_data(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1263 X509 *x, size_t chainidx)
1264 {
1265 if (PACKET_remaining(pkt) != 0) {
1266 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1267 return 0;
1268 }
1269
1270 if (s->hello_retry_request != SSL_HRR_NONE) {
1271 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
1272 return 0;
1273 }
1274
1275 return 1;
1276 }
1277
tls_get_stateful_ticket(SSL_CONNECTION * s,PACKET * tick,SSL_SESSION ** sess)1278 static SSL_TICKET_STATUS tls_get_stateful_ticket(SSL_CONNECTION *s, PACKET *tick,
1279 SSL_SESSION **sess)
1280 {
1281 SSL_SESSION *tmpsess = NULL;
1282
1283 s->ext.ticket_expected = 1;
1284
1285 switch (PACKET_remaining(tick)) {
1286 case 0:
1287 return SSL_TICKET_EMPTY;
1288
1289 case SSL_MAX_SSL_SESSION_ID_LENGTH:
1290 break;
1291
1292 default:
1293 return SSL_TICKET_NO_DECRYPT;
1294 }
1295
1296 tmpsess = lookup_sess_in_cache(s, PACKET_data(tick),
1297 SSL_MAX_SSL_SESSION_ID_LENGTH);
1298
1299 if (tmpsess == NULL)
1300 return SSL_TICKET_NO_DECRYPT;
1301
1302 *sess = tmpsess;
1303 return SSL_TICKET_SUCCESS;
1304 }
1305
tls_parse_ctos_psk(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1306 int tls_parse_ctos_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1307 X509 *x, size_t chainidx)
1308 {
1309 PACKET identities, binders, binder;
1310 size_t binderoffset;
1311 int hashsize;
1312 SSL_SESSION *sess = NULL;
1313 unsigned int id, i, ext = 0;
1314 const EVP_MD *md = NULL;
1315 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1316 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s);
1317
1318 /*
1319 * If we have no PSK kex mode that we recognise then we can't resume so
1320 * ignore this extension
1321 */
1322 if ((s->ext.psk_kex_mode
1323 & (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
1324 return 1;
1325
1326 if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
1327 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1328 return 0;
1329 }
1330
1331 s->ext.ticket_expected = 0;
1332 for (id = 0; PACKET_remaining(&identities) != 0; id++) {
1333 PACKET identity;
1334 unsigned long ticket_agel;
1335 size_t idlen;
1336
1337 if (!PACKET_get_length_prefixed_2(&identities, &identity)
1338 || !PACKET_get_net_4(&identities, &ticket_agel)) {
1339 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1340 return 0;
1341 }
1342
1343 idlen = PACKET_remaining(&identity);
1344 if (s->psk_find_session_cb != NULL
1345 && !s->psk_find_session_cb(ussl, PACKET_data(&identity), idlen,
1346 &sess)) {
1347 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_EXTENSION);
1348 return 0;
1349 }
1350
1351 #ifndef OPENSSL_NO_PSK
1352 if (sess == NULL
1353 && s->psk_server_callback != NULL
1354 && idlen <= PSK_MAX_IDENTITY_LEN) {
1355 char *pskid = NULL;
1356 unsigned char pskdata[PSK_MAX_PSK_LEN];
1357 unsigned int pskdatalen;
1358
1359 if (!PACKET_strndup(&identity, &pskid)) {
1360 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1361 return 0;
1362 }
1363 pskdatalen = s->psk_server_callback(ussl, pskid, pskdata,
1364 sizeof(pskdata));
1365 OPENSSL_free(pskid);
1366 if (pskdatalen > PSK_MAX_PSK_LEN) {
1367 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1368 return 0;
1369 } else if (pskdatalen > 0) {
1370 const SSL_CIPHER *cipher;
1371 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
1372
1373 /*
1374 * We found a PSK using an old style callback. We don't know
1375 * the digest so we default to SHA256 as per the TLSv1.3 spec
1376 */
1377 cipher = SSL_CIPHER_find(SSL_CONNECTION_GET_SSL(s),
1378 tls13_aes128gcmsha256_id);
1379 if (cipher == NULL) {
1380 OPENSSL_cleanse(pskdata, pskdatalen);
1381 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1382 return 0;
1383 }
1384
1385 sess = SSL_SESSION_new();
1386 if (sess == NULL
1387 || !SSL_SESSION_set1_master_key(sess, pskdata,
1388 pskdatalen)
1389 || !SSL_SESSION_set_cipher(sess, cipher)
1390 || !SSL_SESSION_set_protocol_version(sess,
1391 TLS1_3_VERSION)) {
1392 OPENSSL_cleanse(pskdata, pskdatalen);
1393 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1394 goto err;
1395 }
1396 OPENSSL_cleanse(pskdata, pskdatalen);
1397 }
1398 }
1399 #endif /* OPENSSL_NO_PSK */
1400
1401 if (sess != NULL) {
1402 /* We found a PSK */
1403 SSL_SESSION *sesstmp = ssl_session_dup(sess, 0);
1404
1405 if (sesstmp == NULL) {
1406 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1407 goto err;
1408 }
1409 SSL_SESSION_free(sess);
1410 sess = sesstmp;
1411
1412 /*
1413 * We've just been told to use this session for this context so
1414 * make sure the sid_ctx matches up.
1415 */
1416 memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length);
1417 sess->sid_ctx_length = s->sid_ctx_length;
1418 ext = 1;
1419 if (id == 0)
1420 s->ext.early_data_ok = 1;
1421 s->ext.ticket_expected = 1;
1422 } else {
1423 OSSL_TIME t, age, expire;
1424 int ret;
1425
1426 /*
1427 * If we are using anti-replay protection then we behave as if
1428 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1429 * is no point in using full stateless tickets.
1430 */
1431 if ((s->options & SSL_OP_NO_TICKET) != 0
1432 || (s->max_early_data > 0
1433 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))
1434 ret = tls_get_stateful_ticket(s, &identity, &sess);
1435 else
1436 ret = tls_decrypt_ticket(s, PACKET_data(&identity),
1437 PACKET_remaining(&identity), NULL, 0,
1438 &sess);
1439
1440 if (ret == SSL_TICKET_EMPTY) {
1441 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1442 return 0;
1443 }
1444
1445 if (ret == SSL_TICKET_FATAL_ERR_MALLOC
1446 || ret == SSL_TICKET_FATAL_ERR_OTHER) {
1447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1448 return 0;
1449 }
1450 if (ret == SSL_TICKET_NONE || ret == SSL_TICKET_NO_DECRYPT)
1451 continue;
1452
1453 /* Check for replay */
1454 if (s->max_early_data > 0
1455 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0
1456 && !SSL_CTX_remove_session(s->session_ctx, sess)) {
1457 SSL_SESSION_free(sess);
1458 sess = NULL;
1459 continue;
1460 }
1461
1462 age = ossl_time_subtract(ossl_ms2time(ticket_agel),
1463 ossl_ms2time(sess->ext.tick_age_add));
1464 t = ossl_time_subtract(ossl_time_now(), sess->time);
1465
1466 /*
1467 * Although internally we use OSS_TIME which has ns granularity,
1468 * when SSL_SESSION structures are serialised/deserialised we use
1469 * second granularity for the sess->time field. Therefore it could
1470 * appear that the client's ticket age is longer than ours (our
1471 * ticket age calculation should always be slightly longer than the
1472 * client's due to the network latency). Therefore we add 1000ms to
1473 * our age calculation to adjust for rounding errors.
1474 */
1475 expire = ossl_time_add(t, ossl_ms2time(1000));
1476
1477 if (id == 0
1478 && ossl_time_compare(sess->timeout, t) >= 0
1479 && ossl_time_compare(age, expire) <= 0
1480 && ossl_time_compare(ossl_time_add(age, TICKET_AGE_ALLOWANCE),
1481 expire) >= 0) {
1482 /*
1483 * Ticket age is within tolerance and not expired. We allow it
1484 * for early data
1485 */
1486 s->ext.early_data_ok = 1;
1487 }
1488 }
1489
1490 md = ssl_md(sctx, sess->cipher->algorithm2);
1491 if (md == NULL) {
1492 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1493 goto err;
1494 }
1495 if (!EVP_MD_is_a(md,
1496 EVP_MD_get0_name(ssl_md(sctx,
1497 s->s3.tmp.new_cipher->algorithm2)))) {
1498 /* The ciphersuite is not compatible with this session. */
1499 SSL_SESSION_free(sess);
1500 sess = NULL;
1501 s->ext.early_data_ok = 0;
1502 s->ext.ticket_expected = 0;
1503 continue;
1504 }
1505 break;
1506 }
1507
1508 if (sess == NULL)
1509 return 1;
1510
1511 binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data;
1512 hashsize = EVP_MD_get_size(md);
1513 if (hashsize <= 0)
1514 goto err;
1515
1516 if (!PACKET_get_length_prefixed_2(pkt, &binders)) {
1517 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1518 goto err;
1519 }
1520
1521 for (i = 0; i <= id; i++) {
1522 if (!PACKET_get_length_prefixed_1(&binders, &binder)) {
1523 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1524 goto err;
1525 }
1526 }
1527
1528 if (PACKET_remaining(&binder) != (size_t)hashsize) {
1529 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1530 goto err;
1531 }
1532 if (tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data,
1533 binderoffset, PACKET_data(&binder), NULL, sess, 0,
1534 ext) != 1) {
1535 /* SSLfatal() already called */
1536 goto err;
1537 }
1538
1539 s->ext.tick_identity = id;
1540
1541 SSL_SESSION_free(s->session);
1542 s->session = sess;
1543 return 1;
1544 err:
1545 SSL_SESSION_free(sess);
1546 return 0;
1547 }
1548
tls_parse_ctos_post_handshake_auth(SSL_CONNECTION * s,PACKET * pkt,ossl_unused unsigned int context,ossl_unused X509 * x,ossl_unused size_t chainidx)1549 int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION *s, PACKET *pkt,
1550 ossl_unused unsigned int context,
1551 ossl_unused X509 *x,
1552 ossl_unused size_t chainidx)
1553 {
1554 if (PACKET_remaining(pkt) != 0) {
1555 SSLfatal(s, SSL_AD_DECODE_ERROR,
1556 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR);
1557 return 0;
1558 }
1559
1560 s->post_handshake_auth = SSL_PHA_EXT_RECEIVED;
1561
1562 return 1;
1563 }
1564
1565 /*
1566 * Add the server's renegotiation binding
1567 */
tls_construct_stoc_renegotiate(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1568 EXT_RETURN tls_construct_stoc_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
1569 unsigned int context, X509 *x,
1570 size_t chainidx)
1571 {
1572 if (!s->s3.send_connection_binding)
1573 return EXT_RETURN_NOT_SENT;
1574
1575 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1576 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
1577 || !WPACKET_start_sub_packet_u16(pkt)
1578 || !WPACKET_start_sub_packet_u8(pkt)
1579 || !WPACKET_memcpy(pkt, s->s3.previous_client_finished,
1580 s->s3.previous_client_finished_len)
1581 || !WPACKET_memcpy(pkt, s->s3.previous_server_finished,
1582 s->s3.previous_server_finished_len)
1583 || !WPACKET_close(pkt)
1584 || !WPACKET_close(pkt)) {
1585 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1586 return EXT_RETURN_FAIL;
1587 }
1588
1589 return EXT_RETURN_SENT;
1590 }
1591
tls_construct_stoc_server_name(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1592 EXT_RETURN tls_construct_stoc_server_name(SSL_CONNECTION *s, WPACKET *pkt,
1593 unsigned int context, X509 *x,
1594 size_t chainidx)
1595 {
1596 if (s->servername_done != 1)
1597 return EXT_RETURN_NOT_SENT;
1598
1599 /*
1600 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1601 * We just use the servername from the initial handshake.
1602 */
1603 if (s->hit && !SSL_CONNECTION_IS_TLS13(s))
1604 return EXT_RETURN_NOT_SENT;
1605
1606 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
1607 || !WPACKET_put_bytes_u16(pkt, 0)) {
1608 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1609 return EXT_RETURN_FAIL;
1610 }
1611
1612 return EXT_RETURN_SENT;
1613 }
1614
1615 /* Add/include the server's max fragment len extension into ServerHello */
tls_construct_stoc_maxfragmentlen(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1616 EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
1617 unsigned int context, X509 *x,
1618 size_t chainidx)
1619 {
1620 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s->session))
1621 return EXT_RETURN_NOT_SENT;
1622
1623 /*-
1624 * 4 bytes for this extension type and extension length
1625 * 1 byte for the Max Fragment Length code value.
1626 */
1627 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
1628 || !WPACKET_start_sub_packet_u16(pkt)
1629 || !WPACKET_put_bytes_u8(pkt, s->session->ext.max_fragment_len_mode)
1630 || !WPACKET_close(pkt)) {
1631 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1632 return EXT_RETURN_FAIL;
1633 }
1634
1635 return EXT_RETURN_SENT;
1636 }
1637
tls_construct_stoc_ec_pt_formats(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1638 EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
1639 unsigned int context, X509 *x,
1640 size_t chainidx)
1641 {
1642 unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
1643 unsigned long alg_a = s->s3.tmp.new_cipher->algorithm_auth;
1644 int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))
1645 && (s->ext.peer_ecpointformats != NULL);
1646 const unsigned char *plist;
1647 size_t plistlen;
1648
1649 if (!using_ecc)
1650 return EXT_RETURN_NOT_SENT;
1651
1652 tls1_get_formatlist(s, &plist, &plistlen);
1653 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
1654 || !WPACKET_start_sub_packet_u16(pkt)
1655 || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen)
1656 || !WPACKET_close(pkt)) {
1657 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1658 return EXT_RETURN_FAIL;
1659 }
1660
1661 return EXT_RETURN_SENT;
1662 }
1663
tls_construct_stoc_supported_groups(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1664 EXT_RETURN tls_construct_stoc_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
1665 unsigned int context, X509 *x,
1666 size_t chainidx)
1667 {
1668 const uint16_t *groups;
1669 size_t numgroups, i, first = 1;
1670 int version;
1671
1672 /* s->s3.group_id is non zero if we accepted a key_share */
1673 if (s->s3.group_id == 0)
1674 return EXT_RETURN_NOT_SENT;
1675
1676 /* Get our list of supported groups */
1677 tls1_get_supported_groups(s, &groups, &numgroups);
1678 if (numgroups == 0) {
1679 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1680 return EXT_RETURN_FAIL;
1681 }
1682
1683 /* Copy group ID if supported */
1684 version = SSL_version(SSL_CONNECTION_GET_SSL(s));
1685 for (i = 0; i < numgroups; i++) {
1686 uint16_t group = groups[i];
1687
1688 if (tls_valid_group(s, group, version, version, 0, NULL)
1689 && tls_group_allowed(s, group, SSL_SECOP_CURVE_SUPPORTED)) {
1690 if (first) {
1691 /*
1692 * Check if the client is already using our preferred group. If
1693 * so we don't need to add this extension
1694 */
1695 if (s->s3.group_id == group)
1696 return EXT_RETURN_NOT_SENT;
1697
1698 /* Add extension header */
1699 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
1700 /* Sub-packet for supported_groups extension */
1701 || !WPACKET_start_sub_packet_u16(pkt)
1702 || !WPACKET_start_sub_packet_u16(pkt)) {
1703 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1704 return EXT_RETURN_FAIL;
1705 }
1706
1707 first = 0;
1708 }
1709 if (!WPACKET_put_bytes_u16(pkt, group)) {
1710 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1711 return EXT_RETURN_FAIL;
1712 }
1713 }
1714 }
1715
1716 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
1717 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1718 return EXT_RETURN_FAIL;
1719 }
1720
1721 return EXT_RETURN_SENT;
1722 }
1723
tls_construct_stoc_session_ticket(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1724 EXT_RETURN tls_construct_stoc_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
1725 unsigned int context, X509 *x,
1726 size_t chainidx)
1727 {
1728 if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
1729 s->ext.ticket_expected = 0;
1730 return EXT_RETURN_NOT_SENT;
1731 }
1732
1733 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
1734 || !WPACKET_put_bytes_u16(pkt, 0)) {
1735 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1736 return EXT_RETURN_FAIL;
1737 }
1738
1739 return EXT_RETURN_SENT;
1740 }
1741
1742 #ifndef OPENSSL_NO_OCSP
tls_construct_stoc_status_request(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1743 EXT_RETURN tls_construct_stoc_status_request(SSL_CONNECTION *s, WPACKET *pkt,
1744 unsigned int context, X509 *x,
1745 size_t chainidx)
1746 {
1747 /* We don't currently support this extension inside a CertificateRequest */
1748 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
1749 return EXT_RETURN_NOT_SENT;
1750
1751 if (!s->ext.status_expected)
1752 return EXT_RETURN_NOT_SENT;
1753
1754 if (SSL_CONNECTION_IS_TLS13(s) && chainidx != 0)
1755 return EXT_RETURN_NOT_SENT;
1756
1757 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
1758 || !WPACKET_start_sub_packet_u16(pkt)) {
1759 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1760 return EXT_RETURN_FAIL;
1761 }
1762
1763 /*
1764 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1765 * send back an empty extension, with the certificate status appearing as a
1766 * separate message
1767 */
1768 if (SSL_CONNECTION_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) {
1769 /* SSLfatal() already called */
1770 return EXT_RETURN_FAIL;
1771 }
1772 if (!WPACKET_close(pkt)) {
1773 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1774 return EXT_RETURN_FAIL;
1775 }
1776
1777 return EXT_RETURN_SENT;
1778 }
1779 #endif
1780
1781 #ifndef OPENSSL_NO_NEXTPROTONEG
tls_construct_stoc_next_proto_neg(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1782 EXT_RETURN tls_construct_stoc_next_proto_neg(SSL_CONNECTION *s, WPACKET *pkt,
1783 unsigned int context, X509 *x,
1784 size_t chainidx)
1785 {
1786 const unsigned char *npa;
1787 unsigned int npalen;
1788 int ret;
1789 int npn_seen = s->s3.npn_seen;
1790 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1791
1792 s->s3.npn_seen = 0;
1793 if (!npn_seen || sctx->ext.npn_advertised_cb == NULL)
1794 return EXT_RETURN_NOT_SENT;
1795
1796 ret = sctx->ext.npn_advertised_cb(SSL_CONNECTION_GET_USER_SSL(s), &npa,
1797 &npalen, sctx->ext.npn_advertised_cb_arg);
1798 if (ret == SSL_TLSEXT_ERR_OK) {
1799 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
1800 || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) {
1801 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1802 return EXT_RETURN_FAIL;
1803 }
1804 s->s3.npn_seen = 1;
1805 return EXT_RETURN_SENT;
1806 }
1807
1808 return EXT_RETURN_NOT_SENT;
1809 }
1810 #endif
1811
tls_construct_stoc_alpn(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1812 EXT_RETURN tls_construct_stoc_alpn(SSL_CONNECTION *s, WPACKET *pkt, unsigned int context,
1813 X509 *x, size_t chainidx)
1814 {
1815 if (s->s3.alpn_selected == NULL)
1816 return EXT_RETURN_NOT_SENT;
1817
1818 if (!WPACKET_put_bytes_u16(pkt,
1819 TLSEXT_TYPE_application_layer_protocol_negotiation)
1820 || !WPACKET_start_sub_packet_u16(pkt)
1821 || !WPACKET_start_sub_packet_u16(pkt)
1822 || !WPACKET_sub_memcpy_u8(pkt, s->s3.alpn_selected,
1823 s->s3.alpn_selected_len)
1824 || !WPACKET_close(pkt)
1825 || !WPACKET_close(pkt)) {
1826 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1827 return EXT_RETURN_FAIL;
1828 }
1829
1830 return EXT_RETURN_SENT;
1831 }
1832
1833 #ifndef OPENSSL_NO_SRTP
tls_construct_stoc_use_srtp(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1834 EXT_RETURN tls_construct_stoc_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
1835 unsigned int context, X509 *x,
1836 size_t chainidx)
1837 {
1838 if (s->srtp_profile == NULL)
1839 return EXT_RETURN_NOT_SENT;
1840
1841 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
1842 || !WPACKET_start_sub_packet_u16(pkt)
1843 || !WPACKET_put_bytes_u16(pkt, 2)
1844 || !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id)
1845 || !WPACKET_put_bytes_u8(pkt, 0)
1846 || !WPACKET_close(pkt)) {
1847 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1848 return EXT_RETURN_FAIL;
1849 }
1850
1851 return EXT_RETURN_SENT;
1852 }
1853 #endif
1854
tls_construct_stoc_etm(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1855 EXT_RETURN tls_construct_stoc_etm(SSL_CONNECTION *s, WPACKET *pkt,
1856 unsigned int context,
1857 X509 *x, size_t chainidx)
1858 {
1859 if (!s->ext.use_etm)
1860 return EXT_RETURN_NOT_SENT;
1861
1862 /*
1863 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1864 * for other cases too.
1865 */
1866 if (s->s3.tmp.new_cipher->algorithm_mac == SSL_AEAD
1867 || s->s3.tmp.new_cipher->algorithm_enc == SSL_RC4
1868 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT
1869 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12
1870 || s->s3.tmp.new_cipher->algorithm_enc == SSL_MAGMA
1871 || s->s3.tmp.new_cipher->algorithm_enc == SSL_KUZNYECHIK) {
1872 s->ext.use_etm = 0;
1873 return EXT_RETURN_NOT_SENT;
1874 }
1875
1876 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
1877 || !WPACKET_put_bytes_u16(pkt, 0)) {
1878 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1879 return EXT_RETURN_FAIL;
1880 }
1881
1882 return EXT_RETURN_SENT;
1883 }
1884
tls_construct_stoc_ems(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1885 EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt,
1886 unsigned int context,
1887 X509 *x, size_t chainidx)
1888 {
1889 if ((s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
1890 return EXT_RETURN_NOT_SENT;
1891
1892 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
1893 || !WPACKET_put_bytes_u16(pkt, 0)) {
1894 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1895 return EXT_RETURN_FAIL;
1896 }
1897
1898 return EXT_RETURN_SENT;
1899 }
1900
tls_construct_stoc_supported_versions(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1901 EXT_RETURN tls_construct_stoc_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
1902 unsigned int context, X509 *x,
1903 size_t chainidx)
1904 {
1905 if (!ossl_assert(SSL_CONNECTION_IS_TLS13(s))) {
1906 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1907 return EXT_RETURN_FAIL;
1908 }
1909
1910 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
1911 || !WPACKET_start_sub_packet_u16(pkt)
1912 || !WPACKET_put_bytes_u16(pkt, s->version)
1913 || !WPACKET_close(pkt)) {
1914 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1915 return EXT_RETURN_FAIL;
1916 }
1917
1918 return EXT_RETURN_SENT;
1919 }
1920
tls_construct_stoc_key_share(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1921 EXT_RETURN tls_construct_stoc_key_share(SSL_CONNECTION *s, WPACKET *pkt,
1922 unsigned int context, X509 *x,
1923 size_t chainidx)
1924 {
1925 #ifndef OPENSSL_NO_TLS1_3
1926 unsigned char *encoded_pubkey;
1927 size_t encoded_pubkey_len = 0;
1928 EVP_PKEY *ckey = s->s3.peer_tmp, *skey = NULL;
1929 const TLS_GROUP_INFO *ginf = NULL;
1930
1931 if (s->hello_retry_request == SSL_HRR_PENDING) {
1932 if (ckey != NULL) {
1933 /* Original key_share was acceptable so don't ask for another one */
1934 return EXT_RETURN_NOT_SENT;
1935 }
1936 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1937 || !WPACKET_start_sub_packet_u16(pkt)
1938 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)
1939 || !WPACKET_close(pkt)) {
1940 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1941 return EXT_RETURN_FAIL;
1942 }
1943
1944 return EXT_RETURN_SENT;
1945 }
1946
1947 if (ckey == NULL) {
1948 /* No key_share received from client - must be resuming */
1949 if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) {
1950 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1951 return EXT_RETURN_FAIL;
1952 }
1953 return EXT_RETURN_NOT_SENT;
1954 }
1955
1956 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0) {
1957 /*
1958 * PSK ('hit') and explicitly not doing DHE. If the client sent the
1959 * DHE option, we take it by default, except if non-DHE would be
1960 * preferred by config, but this case would have been handled in
1961 * tls_parse_ctos_psk_kex_modes().
1962 */
1963 return EXT_RETURN_NOT_SENT;
1964 }
1965
1966 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1967 || !WPACKET_start_sub_packet_u16(pkt)
1968 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)) {
1969 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1970 return EXT_RETURN_FAIL;
1971 }
1972
1973 if ((ginf = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
1974 s->s3.group_id)) == NULL) {
1975 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1976 return EXT_RETURN_FAIL;
1977 }
1978
1979 if (!ginf->is_kem) {
1980 /* Regular KEX */
1981 skey = ssl_generate_pkey(s, ckey);
1982 if (skey == NULL) {
1983 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
1984 return EXT_RETURN_FAIL;
1985 }
1986
1987 /* Generate encoding of server key */
1988 encoded_pubkey_len = EVP_PKEY_get1_encoded_public_key(skey, &encoded_pubkey);
1989 if (encoded_pubkey_len == 0) {
1990 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
1991 EVP_PKEY_free(skey);
1992 return EXT_RETURN_FAIL;
1993 }
1994
1995 if (!WPACKET_sub_memcpy_u16(pkt, encoded_pubkey, encoded_pubkey_len)
1996 || !WPACKET_close(pkt)) {
1997 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1998 EVP_PKEY_free(skey);
1999 OPENSSL_free(encoded_pubkey);
2000 return EXT_RETURN_FAIL;
2001 }
2002 OPENSSL_free(encoded_pubkey);
2003
2004 /*
2005 * This causes the crypto state to be updated based on the derived keys
2006 */
2007 s->s3.tmp.pkey = skey;
2008 if (ssl_derive(s, skey, ckey, 1) == 0) {
2009 /* SSLfatal() already called */
2010 return EXT_RETURN_FAIL;
2011 }
2012 } else {
2013 /* KEM mode */
2014 unsigned char *ct = NULL;
2015 size_t ctlen = 0;
2016
2017 /*
2018 * This does not update the crypto state.
2019 *
2020 * The generated pms is stored in `s->s3.tmp.pms` to be later used via
2021 * ssl_gensecret().
2022 */
2023 if (ssl_encapsulate(s, ckey, &ct, &ctlen, 0) == 0) {
2024 /* SSLfatal() already called */
2025 return EXT_RETURN_FAIL;
2026 }
2027
2028 if (ctlen == 0) {
2029 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2030 OPENSSL_free(ct);
2031 return EXT_RETURN_FAIL;
2032 }
2033
2034 if (!WPACKET_sub_memcpy_u16(pkt, ct, ctlen)
2035 || !WPACKET_close(pkt)) {
2036 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2037 OPENSSL_free(ct);
2038 return EXT_RETURN_FAIL;
2039 }
2040 OPENSSL_free(ct);
2041
2042 /*
2043 * This causes the crypto state to be updated based on the generated pms
2044 */
2045 if (ssl_gensecret(s, s->s3.tmp.pms, s->s3.tmp.pmslen) == 0) {
2046 /* SSLfatal() already called */
2047 return EXT_RETURN_FAIL;
2048 }
2049 }
2050 s->s3.did_kex = 1;
2051 return EXT_RETURN_SENT;
2052 #else
2053 return EXT_RETURN_FAIL;
2054 #endif
2055 }
2056
tls_construct_stoc_cookie(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2057 EXT_RETURN tls_construct_stoc_cookie(SSL_CONNECTION *s, WPACKET *pkt,
2058 unsigned int context,
2059 X509 *x, size_t chainidx)
2060 {
2061 #ifndef OPENSSL_NO_TLS1_3
2062 unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie;
2063 unsigned char *hmac, *hmac2;
2064 size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen;
2065 EVP_MD_CTX *hctx;
2066 EVP_PKEY *pkey;
2067 int ret = EXT_RETURN_FAIL;
2068 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2069 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
2070 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s);
2071
2072 if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0)
2073 return EXT_RETURN_NOT_SENT;
2074
2075 if (sctx->gen_stateless_cookie_cb == NULL) {
2076 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_COOKIE_CALLBACK_SET);
2077 return EXT_RETURN_FAIL;
2078 }
2079
2080 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
2081 || !WPACKET_start_sub_packet_u16(pkt)
2082 || !WPACKET_start_sub_packet_u16(pkt)
2083 || !WPACKET_get_total_written(pkt, &startlen)
2084 || !WPACKET_reserve_bytes(pkt, MAX_COOKIE_SIZE, &cookie)
2085 || !WPACKET_put_bytes_u16(pkt, COOKIE_STATE_FORMAT_VERSION)
2086 || !WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION)
2087 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)
2088 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, pkt,
2089 &ciphlen)
2090 /* Is there a key_share extension present in this HRR? */
2091 || !WPACKET_put_bytes_u8(pkt, s->s3.peer_tmp == NULL)
2092 || !WPACKET_put_bytes_u64(pkt, time(NULL))
2093 || !WPACKET_start_sub_packet_u16(pkt)
2094 || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &hashval1)) {
2095 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2096 return EXT_RETURN_FAIL;
2097 }
2098
2099 /*
2100 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
2101 * on raw buffers, so we first reserve sufficient bytes (above) and then
2102 * subsequently allocate them (below)
2103 */
2104 if (!ssl3_digest_cached_records(s, 0)
2105 || !ssl_handshake_hash(s, hashval1, EVP_MAX_MD_SIZE, &hashlen)) {
2106 /* SSLfatal() already called */
2107 return EXT_RETURN_FAIL;
2108 }
2109
2110 if (!WPACKET_allocate_bytes(pkt, hashlen, &hashval2)
2111 || !ossl_assert(hashval1 == hashval2)
2112 || !WPACKET_close(pkt)
2113 || !WPACKET_start_sub_packet_u8(pkt)
2114 || !WPACKET_reserve_bytes(pkt, SSL_COOKIE_LENGTH, &appcookie1)) {
2115 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2116 return EXT_RETURN_FAIL;
2117 }
2118
2119 /* Generate the application cookie */
2120 if (sctx->gen_stateless_cookie_cb(ussl, appcookie1,
2121 &appcookielen) == 0) {
2122 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
2123 return EXT_RETURN_FAIL;
2124 }
2125
2126 if (!WPACKET_allocate_bytes(pkt, appcookielen, &appcookie2)
2127 || !ossl_assert(appcookie1 == appcookie2)
2128 || !WPACKET_close(pkt)
2129 || !WPACKET_get_total_written(pkt, &totcookielen)
2130 || !WPACKET_reserve_bytes(pkt, SHA256_DIGEST_LENGTH, &hmac)) {
2131 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2132 return EXT_RETURN_FAIL;
2133 }
2134 hmaclen = SHA256_DIGEST_LENGTH;
2135
2136 totcookielen -= startlen;
2137 if (!ossl_assert(totcookielen <= MAX_COOKIE_SIZE - SHA256_DIGEST_LENGTH)) {
2138 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2139 return EXT_RETURN_FAIL;
2140 }
2141
2142 /* HMAC the cookie */
2143 hctx = EVP_MD_CTX_create();
2144 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC",
2145 sctx->propq,
2146 s->session_ctx->ext.cookie_hmac_key,
2147 sizeof(s->session_ctx->ext.cookie_hmac_key));
2148 if (hctx == NULL || pkey == NULL) {
2149 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
2150 goto err;
2151 }
2152
2153 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx,
2154 sctx->propq, pkey, NULL) <= 0
2155 || EVP_DigestSign(hctx, hmac, &hmaclen, cookie,
2156 totcookielen) <= 0) {
2157 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2158 goto err;
2159 }
2160
2161 if (!ossl_assert(totcookielen + hmaclen <= MAX_COOKIE_SIZE)) {
2162 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2163 goto err;
2164 }
2165
2166 if (!WPACKET_allocate_bytes(pkt, hmaclen, &hmac2)
2167 || !ossl_assert(hmac == hmac2)
2168 || !ossl_assert(cookie == hmac - totcookielen)
2169 || !WPACKET_close(pkt)
2170 || !WPACKET_close(pkt)) {
2171 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2172 goto err;
2173 }
2174
2175 ret = EXT_RETURN_SENT;
2176
2177 err:
2178 EVP_MD_CTX_free(hctx);
2179 EVP_PKEY_free(pkey);
2180 return ret;
2181 #else
2182 return EXT_RETURN_FAIL;
2183 #endif
2184 }
2185
tls_construct_stoc_cryptopro_bug(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2186 EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL_CONNECTION *s, WPACKET *pkt,
2187 unsigned int context, X509 *x,
2188 size_t chainidx)
2189 {
2190 const unsigned char cryptopro_ext[36] = {
2191 0xfd, 0xe8, /* 65000 */
2192 0x00, 0x20, /* 32 bytes length */
2193 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
2194 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
2195 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
2196 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
2197 };
2198
2199 if (((s->s3.tmp.new_cipher->id & 0xFFFF) != 0x80
2200 && (s->s3.tmp.new_cipher->id & 0xFFFF) != 0x81)
2201 || (SSL_get_options(SSL_CONNECTION_GET_SSL(s))
2202 & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0)
2203 return EXT_RETURN_NOT_SENT;
2204
2205 if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) {
2206 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2207 return EXT_RETURN_FAIL;
2208 }
2209
2210 return EXT_RETURN_SENT;
2211 }
2212
tls_construct_stoc_early_data(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2213 EXT_RETURN tls_construct_stoc_early_data(SSL_CONNECTION *s, WPACKET *pkt,
2214 unsigned int context, X509 *x,
2215 size_t chainidx)
2216 {
2217 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
2218 if (s->max_early_data == 0)
2219 return EXT_RETURN_NOT_SENT;
2220
2221 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
2222 || !WPACKET_start_sub_packet_u16(pkt)
2223 || !WPACKET_put_bytes_u32(pkt, s->max_early_data)
2224 || !WPACKET_close(pkt)) {
2225 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2226 return EXT_RETURN_FAIL;
2227 }
2228
2229 return EXT_RETURN_SENT;
2230 }
2231
2232 if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
2233 return EXT_RETURN_NOT_SENT;
2234
2235 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
2236 || !WPACKET_start_sub_packet_u16(pkt)
2237 || !WPACKET_close(pkt)) {
2238 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2239 return EXT_RETURN_FAIL;
2240 }
2241
2242 return EXT_RETURN_SENT;
2243 }
2244
tls_construct_stoc_psk(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2245 EXT_RETURN tls_construct_stoc_psk(SSL_CONNECTION *s, WPACKET *pkt,
2246 unsigned int context,
2247 X509 *x, size_t chainidx)
2248 {
2249 if (!s->hit)
2250 return EXT_RETURN_NOT_SENT;
2251
2252 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
2253 || !WPACKET_start_sub_packet_u16(pkt)
2254 || !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity)
2255 || !WPACKET_close(pkt)) {
2256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2257 return EXT_RETURN_FAIL;
2258 }
2259
2260 return EXT_RETURN_SENT;
2261 }
2262
tls_construct_stoc_client_cert_type(SSL_CONNECTION * sc,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2263 EXT_RETURN tls_construct_stoc_client_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
2264 unsigned int context,
2265 X509 *x, size_t chainidx)
2266 {
2267 if (sc->ext.client_cert_type_ctos == OSSL_CERT_TYPE_CTOS_ERROR
2268 && (send_certificate_request(sc)
2269 || sc->post_handshake_auth == SSL_PHA_EXT_RECEIVED)) {
2270 /* Did not receive an acceptable cert type - and doing client auth */
2271 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION);
2272 return EXT_RETURN_FAIL;
2273 }
2274
2275 if (sc->ext.client_cert_type == TLSEXT_cert_type_x509) {
2276 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2277 return EXT_RETURN_NOT_SENT;
2278 }
2279
2280 /*
2281 * Note: only supposed to send this if we are going to do a cert request,
2282 * but TLSv1.3 could do a PHA request if the client supports it
2283 */
2284 if ((!send_certificate_request(sc) && sc->post_handshake_auth != SSL_PHA_EXT_RECEIVED)
2285 || sc->ext.client_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD
2286 || sc->client_cert_type == NULL) {
2287 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
2288 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2289 sc->ext.client_cert_type = TLSEXT_cert_type_x509;
2290 return EXT_RETURN_NOT_SENT;
2291 }
2292
2293 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_client_cert_type)
2294 || !WPACKET_start_sub_packet_u16(pkt)
2295 || !WPACKET_put_bytes_u8(pkt, sc->ext.client_cert_type)
2296 || !WPACKET_close(pkt)) {
2297 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2298 return EXT_RETURN_FAIL;
2299 }
2300 return EXT_RETURN_SENT;
2301 }
2302
2303 /* One of |pref|, |other| is configured and the values are sanitized */
reconcile_cert_type(const unsigned char * pref,size_t pref_len,const unsigned char * other,size_t other_len,uint8_t * chosen_cert_type)2304 static int reconcile_cert_type(const unsigned char *pref, size_t pref_len,
2305 const unsigned char *other, size_t other_len,
2306 uint8_t *chosen_cert_type)
2307 {
2308 size_t i;
2309
2310 for (i = 0; i < pref_len; i++) {
2311 if (memchr(other, pref[i], other_len) != NULL) {
2312 *chosen_cert_type = pref[i];
2313 return OSSL_CERT_TYPE_CTOS_GOOD;
2314 }
2315 }
2316 return OSSL_CERT_TYPE_CTOS_ERROR;
2317 }
2318
tls_parse_ctos_client_cert_type(SSL_CONNECTION * sc,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2319 int tls_parse_ctos_client_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
2320 unsigned int context,
2321 X509 *x, size_t chainidx)
2322 {
2323 PACKET supported_cert_types;
2324 const unsigned char *data;
2325 size_t len;
2326
2327 /* Ignore the extension */
2328 if (sc->client_cert_type == NULL) {
2329 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2330 sc->ext.client_cert_type = TLSEXT_cert_type_x509;
2331 return 1;
2332 }
2333
2334 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) {
2335 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2336 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2337 return 0;
2338 }
2339 if ((len = PACKET_remaining(&supported_cert_types)) == 0) {
2340 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2341 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2342 return 0;
2343 }
2344 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) {
2345 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2346 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2347 return 0;
2348 }
2349 /* client_cert_type: client (peer) has priority */
2350 sc->ext.client_cert_type_ctos = reconcile_cert_type(data, len,
2351 sc->client_cert_type, sc->client_cert_type_len,
2352 &sc->ext.client_cert_type);
2353
2354 /* Ignore the error until sending - so we can check cert auth*/
2355 return 1;
2356 }
2357
tls_construct_stoc_server_cert_type(SSL_CONNECTION * sc,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2358 EXT_RETURN tls_construct_stoc_server_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
2359 unsigned int context,
2360 X509 *x, size_t chainidx)
2361 {
2362 if (sc->ext.server_cert_type == TLSEXT_cert_type_x509) {
2363 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2364 return EXT_RETURN_NOT_SENT;
2365 }
2366 if (sc->ext.server_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD
2367 || sc->server_cert_type == NULL) {
2368 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
2369 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2370 sc->ext.server_cert_type = TLSEXT_cert_type_x509;
2371 return EXT_RETURN_NOT_SENT;
2372 }
2373
2374 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_cert_type)
2375 || !WPACKET_start_sub_packet_u16(pkt)
2376 || !WPACKET_put_bytes_u8(pkt, sc->ext.server_cert_type)
2377 || !WPACKET_close(pkt)) {
2378 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2379 return EXT_RETURN_FAIL;
2380 }
2381 return EXT_RETURN_SENT;
2382 }
2383
tls_parse_ctos_server_cert_type(SSL_CONNECTION * sc,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)2384 int tls_parse_ctos_server_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
2385 unsigned int context,
2386 X509 *x, size_t chainidx)
2387 {
2388 PACKET supported_cert_types;
2389 const unsigned char *data;
2390 size_t len;
2391
2392 /* Ignore the extension */
2393 if (sc->server_cert_type == NULL) {
2394 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2395 sc->ext.server_cert_type = TLSEXT_cert_type_x509;
2396 return 1;
2397 }
2398
2399 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) {
2400 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2401 return 0;
2402 }
2403
2404 if ((len = PACKET_remaining(&supported_cert_types)) == 0) {
2405 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2406 return 0;
2407 }
2408 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) {
2409 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2410 return 0;
2411 }
2412 /* server_cert_type: server (this) has priority */
2413 sc->ext.server_cert_type_ctos = reconcile_cert_type(sc->server_cert_type, sc->server_cert_type_len,
2414 data, len,
2415 &sc->ext.server_cert_type);
2416 if (sc->ext.server_cert_type_ctos == OSSL_CERT_TYPE_CTOS_GOOD)
2417 return 1;
2418
2419 /* Did not receive an acceptable cert type */
2420 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION);
2421 return 0;
2422 }
2423